C:\Dev\Unreal3.2\WIRCD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dd60ff79659df9c541ee9e806224fd7c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd60ff79659df9c541ee9e806224fd7c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dd60ff79659df9c541ee9e806224fd7c_JaffaCakes118
-
Size
760KB
-
MD5
dd60ff79659df9c541ee9e806224fd7c
-
SHA1
1141deda4a97001d56fe248f56adddc4545ec3e4
-
SHA256
d882177a5b4ba7fa4acc0e2839851ffe4d44500d13531a13974e60bd5357cd83
-
SHA512
5a51302ca9923a60690b1f94e4e946926a2e28c70fbdbde81a616ded095394aa96b8f8bd34edb628b8ff81ddd46bf745d5b9d41056db6faf00fced6f717dca24
-
SSDEEP
12288:vGhbOLE4OlBm8LnRLi5KumQIoYcVE60bws:eMA4OjTnE5AcVEpEs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd60ff79659df9c541ee9e806224fd7c_JaffaCakes118
Files
-
dd60ff79659df9c541ee9e806224fd7c_JaffaCakes118.exe windows:4 windows x86 arch:x86
08ca9f4ffec196f545937a2f91a9528e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetVersion
SetUnhandledExceptionFilter
GetCurrentThread
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
lstrlenA
GetVersionExA
GlobalMemoryStatus
FormatMessageA
LoadLibraryA
GetSystemTimeAsFileTime
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
WinExec
GetLastError
GetCommandLineA
SetErrorMode
CreateMutexA
CloseHandle
SetFileTime
CreateFileA
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileTime
Sleep
GetStartupInfoA
ExitProcess
FindFirstFileA
GetProcAddress
FindClose
FindNextFileA
user32
GetClientRect
DestroyWindow
TranslateMessage
IsDialogMessageA
IsWindow
GetMessageA
ShowWindow
CreateDialogParamA
RegisterWindowMessageA
DialogBoxParamA
GetMenuStringA
SetMenuItemInfoA
GetWindowTextA
AppendMenuA
CreatePopupMenu
DestroyMenu
ClientToScreen
SetForegroundWindow
SetWindowTextA
ModifyMenuA
GetSubMenu
LoadMenuA
EndDialog
SetWindowLongA
GetDlgItem
wsprintfA
GetWindowLongA
GetParent
TrackPopupMenu
LoadCursorA
SetCursor
CallWindowProcA
LoadImageA
MessageBoxA
SendMessageA
GetCursorPos
EnableMenuItem
DrawFocusRect
CopyRect
DrawTextA
FillRect
GetSysColorBrush
SetClipboardViewer
GetWindowRect
SetWindowPos
ChangeClipboardChain
GetDlgItemInt
SetFocus
DrawEdge
CreateWindowExA
MessageBeep
SetDlgItemTextA
SetDlgItemInt
SetTimer
DispatchMessageA
gdi32
DeleteObject
CreateFontA
CreateSolidBrush
SetTextColor
shell32
Shell_NotifyIconA
ShellExecuteA
ws2_32
WSAGetLastError
send
inet_ntoa
gethostname
getpeername
recv
WSASetLastError
WSACleanup
getsockopt
listen
setsockopt
ioctlsocket
accept
__WSAFDIsSet
select
htonl
ntohl
inet_addr
closesocket
WSAStartup
connect
htons
bind
getsockname
socket
sendto
ntohs
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
QueryServiceStatus
StartServiceA
CloseServiceHandle
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SetServiceStatus
OpenSCManagerA
OpenServiceA
ControlService
dbghelp
SymFunctionTableAccess
SymGetModuleBase
StackWalk
SymSetOptions
SymInitialize
SymGetLineFromAddr
SymGetSymFromAddr
SymGetModuleInfo
comctl32
ord17
CreateToolbarEx
ord6
comdlg32
GetSaveFileNameA
FindTextA
zlibwapi
inflateEnd
deflateEnd
inflateInit_
deflateInit_
deflate
inflate
zlibVersion
libcurl
curl_version
curl_easy_cleanup
curl_easy_getinfo
curl_easy_perform
curl_easy_setopt
curl_multi_perform
curl_multi_init
curl_global_init
curl_multi_add_handle
curl_multi_remove_handle
curl_multi_info_read
curl_multi_fdset
curl_easy_init
tre
ord4
ord3
ord6
ord5
msvcr70
_itoa
ctime
gmtime
localtime
_timezone
sscanf
signal
printf
exit
fopen
fprintf
fclose
memcmp
remove
atol
vsprintf
_errno
strerror
strtok
memcpy
atoi
strncat
abort
strncpy
strrchr
strcat
sprintf
strncmp
strcmp
_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
isxdigit
strlen
strchr
strcpy
time
memset
free
malloc
strftime
_iob
fgets
calloc
strtoul
_ftime
fwrite
_beginthread
__p___argv
__p___argc
asctime
_strdup
_read
_close
_fstat
_open
strstr
_mkdir
_chdir
_unlink
_write
_fileno
isdigit
isupper
tolower
getenv
isspace
realloc
_stat
_getpid
Exports
Exports
AllUmodes
AllowClient
AuthTypes
Auth_Check
Auth_CheckError
Auth_ConvertConf2AuthStruct
Auth_DeleteAuthStruct
Auth_FindType
Auth_Make
CallCmdoverride
CallbackAddMain
CallbackDel
Callbacks
Channelmode_Table
Channelmode_highest
CmdoverrideAdd
CmdoverrideDel
CmodeAdd
CmodeDel
CommandAdd
CommandDel
CommandExists
CommandHash
DCCdeny_add
DCCdeny_del
DeleteTempModules
DoEvents
DoMD5
DoesOp
EXTMODE_JOINTHROTTLE
EXTMODE_NONOTICE
EXTMODE_STRIPBADWORDS
EfunctionAddMain
EfunctionDel
Efunctions
EventAddEx
EventDel
EventFind
EventMarkDel
EventMod
EventStatus
ExtBan_Table
ExtBan_highest
ExtbanAdd
ExtbanDel
Find_Help
Find_alias
Find_ban
Find_banEx
Find_cgiirc
Find_channel_allowed
Find_class
Find_deny_dcc
Find_except
Find_link
Find_listen
Find_oper
Find_tld
Find_uline
Find_vhost
HTMLOCK
Halfop_mode
HookAddMain
HookDel
Hooks
HooktypeAdd
HooktypeDel
HooktypeFind
Hooktypes
IRCstats
Inet_ia2p
Inet_ia2pNB
Inet_si2p
Inet_si2pB
Init_all_testing_modules
InitwIRCD
IsupportAdd
IsupportDel
IsupportFind
IsupportSetValue
IsupportStrings
Isupports
LCF
LRV
LastSlot
LockEventSystem
MD5_Final
MD5_Init
MD5_Update
ModuleGetError
ModuleGetErrorStr
ModuleGetOptions
ModuleSetOptions
Module_AddAsChild
Module_Create
Module_DelayChildren
Module_Depend_Resolve
Module_Find
Module_Init
Module_IsAlreadyChild
Module_Sym
Module_SymEx
Module_SymX
Module_Unload
Module_free
Module_make
Modules
MyMallocEx
NOW
OpenFiles
RCallbacks
REPORT_DO_DNS
REPORT_DO_ID
REPORT_FAIL_DNS
REPORT_FAIL_ID
REPORT_FIN_DNS
REPORT_FIN_DNSC
REPORT_FIN_ID
R_do_dns
R_do_id
R_fail_dns
R_fail_id
R_fin_dns
R_fin_dnsc
R_fin_id
SJSynchList
SNO_CLIENT
SNO_EYES
SNO_FCLIENT
SNO_FLOOD
SNO_FNICKCHANGE
SNO_JUNK
SNO_KILLS
SNO_NICKCHANGE
SNO_OPER
SNO_QLINE
SNO_SNOTICE
SNO_SPAMF
SNO_TKL
SNO_VHOST
SVSNOOP
SendUmodes
Servers
SetupEvents
SnomaskAdd
SnomaskDel
Snomask_Table
Snomask_highest
SocketLoop
StatsZ
StripColors
StripControlCodes
TS2ts
TSoffset
ThrottlingHash
TokenHash
UMODE_ADMIN
UMODE_BOT
UMODE_COADMIN
UMODE_DEAF
UMODE_FAILOP
UMODE_HELPOP
UMODE_HIDE
UMODE_HIDEOPER
UMODE_HIDEWHOIS
UMODE_INVISIBLE
UMODE_KIX
UMODE_LOCOP
UMODE_NETADMIN
UMODE_NOCTCP
UMODE_OPER
UMODE_REGNICK
UMODE_RGSTRONLY
UMODE_SADMIN
UMODE_SECURE
UMODE_SERVICES
UMODE_SERVNOTICE
UMODE_SETHOST
UMODE_STRIPBADWORDS
UMODE_VICTIM
UMODE_WALLOP
UMODE_WEBTV
UMODE_WHOIS
UmodeAdd
UmodeDel
Unload_all_loaded_modules
Unload_all_testing_modules
UnlockEventSystem
Usermode_Table
Usermode_highest
VersionflagAdd
VersionflagDel
VersionflagFind
Versionflags
WHOWAS
WHOWASHASH
WSAErrors
_match
add_Command
add_CommandX
add_Command_backend
add_ListItem
add_client_to_list
add_connection
add_dccallow
add_entropy_configfile
add_history
add_include
add_invite
add_listener2
add_listmode
add_local_client
add_local_domain
add_remote_include
add_server_to_table
add_silence
add_throttling_bucket
add_to_channel_hash_table
add_to_client_hash_table
add_to_watch_hash_table
add_user_to_channel
addto_fdlist
advanced_check
applymeblock
areason
atime
atime_exp
atoi_tab
b64_decode
b64_encode
backupbuf
ban_cloakhost
ban_flooder
ban_ip
ban_realhost
ban_virthost
banact_chartoval
banact_stringtoval
banact_valtochar
banact_valtostring
base64_to_int6_map
base64dec
base64enc
booted
bootopt
botmotd
buildid
busycli_fdlist
cFlagTab
callbacks_check
callbacks_switchover
can_join
can_send
canonize
chanfloodtimer_add
chanfloodtimer_del
chanfloodtimer_find
chanfloodtimer_stopchantimers
channel
channel_canjoin
channel_modef_string
channel_modes
char_atribs
charsys_add_language
charsys_addallowed
charsys_addmultibyterange
charsys_finish
charsys_postconftest
charsys_reset
charsys_reset_pretest
charsys_test_language
check_channelmask
check_client
check_fdlists
check_for_chan_flood
check_for_target_limit
check_pings
check_registered
check_registered_user
check_string
checklist
chess
chmode_str
clean_ban_mask
clean_channelname
clear_channel_hash_table
clear_client_hash_table
clear_scache_hash_table
clear_watch_hash_table
client
close_connection
close_connections
close_listeners
cmdLine
cmdname_by_spamftarget
cmdstr
cmodej_addentry
cmodej_cleanup_structs
cmodej_conv_param
cmodej_delchannelentries
cmodej_delentry
cmodej_deluserentries
cmodej_dup_struct
cmodej_free_param
cmodej_get_param
cmodej_is_ok
cmodej_put_param
cmodej_sjoin_check
cmodestring
collapse
completed_connection
conf
conf_admin
conf_admin_tail
conf_alias
conf_allow
conf_allow_channel
conf_allow_dcc
conf_badword_channel
conf_badword_message
conf_badword_quit
conf_ban
conf_cgiirc
conf_class
conf_debuglevel
conf_deny_channel
conf_deny_dcc
conf_deny_link
conf_deny_version
conf_drpass
conf_except
conf_help
conf_include
conf_link
conf_listen
conf_log
conf_me
conf_offchans
conf_oper
conf_tld
conf_ulines
conf_vhost
config_binary_flags_search
config_binary_search
config_checkval
config_error
config_error_flag
config_find_entry
config_free
config_load
config_parse_flood
config_post_test
config_progress
config_rehash
config_run
config_setdefaultsettings
config_status
config_test
config_verbose
config_warn
configfile
connect_server
convert_time
count_oper_sessions
count_scache
count_watch_memory
count_whowas_memory
create_snomask
create_tkl_except
creation
crule__andor
crule__not
crule_connected
crule_directcon
crule_directop
crule_errstr
crule_errstring
crule_eval
crule_free
crule_funclist
crule_gettoken
crule_getword
crule_parse
crule_parseandexpr
crule_parsearglist
crule_parsefunction
crule_parseorexpr
crule_parseprimary
crule_test
crule_via
currentrate
currentrate2
currlife
dalinfotext
date
dbuf_delete
dbuf_get
dbuf_getmsg
dbuf_map
dbuf_put
dbufalloc
dbufblocks
dcc_isdiscouraged
dcc_isforbidden
dcc_sync
dcc_wipe_services
debuglevel
debugmode
decode_ip
default_class
default_fdlist
del_Command
del_ListItem
del_dccallow
del_from_channel_hash_table
del_from_client_hash_table
del_from_watch_hash_table
del_invite
del_listmode
del_silence
del_throttling_bucket
delete_cgiircblock
delete_classblock
delete_linkblock
delfrom_fdlist
deliver_it
dgets
dnsstats
do_chanflood
do_chanflood_action
do_cmd
do_join
do_mode
do_nick_name
do_numeric
do_remote_nick_name
dontspread
dopacket
dospamfilter
dospamfilter_viruschan
e_check_fdlists
e_clean_out_throttling_buckets
e_unload_module_delayed
efunctions_check
efunctions_switchover
encode_ip
events
exit_client
extban_conv_param_nuh
extban_init
extban_is_banned_helper
extban_modec_conv_param
extban_modec_is_banned
extban_modec_is_ok
extban_moden_is_banned
extban_modeq_is_banned
extban_moder_conv_param
extban_moder_is_banned
extbanstr
extchmstr
extcmode_cmodeG_requirechop
extcmode_cmodeT_requirechop
extcmode_default_requirechop
extcmode_default_requirehalfop
extcmode_duplicate_paramlist
extcmode_free_paramlist
extcmode_get_struct
extcmode_init
extracttime
extraflags
file_exists
find_Command
find_CommandEx
find_Command_simple
find_by_hash
find_chasing
find_client
find_invex
find_loaded_remote_include
find_match_server
find_member_link
find_membership_link
find_name
find_nickserv
find_or_add
find_person
find_qline
find_remote_include
find_server
find_server_b64_or_real
find_server_by_base64
find_server_by_numeric
find_server_id
find_server_quick_search
find_server_quick_straight
find_server_quickx
find_shun
find_spamfilter_user
find_str_match_link
find_throttling_bucket
Sections
.text Size: 408KB - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ